revengerat | 7a3d37a6aa63c8cda5e1029a19644d5890d8dd723f370993abea447ddc936c68

General

Target

30de81edb8646763d284c5f9a401a04a.exe
Size

73KB
MD5

30de81edb8646763d284c5f9a401a04a
SHA1

1ef306a9fabb9b5e1ec3d4bcb122de49c5eaf105
SHA256

7a3d37a6aa63c8cda5e1029a19644d5890d8dd723f370993abea447ddc936c68
SHA512

022450d2c03a11a8a99d5d570f261bb8ea2432528bc0a6da1dac74b4a3f21abd4c30c4d5b19aee5e2be160b39999444206c6fa7717fa9fd757eaaaf67d28cc19

Score

10^/10

revengerat stealer trojan

Malware Config

Signatures

RevengeRAT
Remote-access trojan with a wide range of capabilities.
trojan revengerat

RevengeRat Executable 3 IoCs

stealer

Processes:

resource	yara_rule
behavioral1/memory/1928-0-0x0000000000400000-0x0000000000416000-memory.dmp	revengerat
behavioral1/memory/1928-1-0x000000000040FE0E-mapping.dmp	revengerat
behavioral1/memory/1928-2-0x0000000000400000-0x0000000000416000-memory.dmp	revengerat

Drops startup file 4 IoCs

Processes:

MSBuild.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\questions.vbs	MSBuild.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\questions.js	MSBuild.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\questions.lnk	MSBuild.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\questions.URL	MSBuild.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

30de81edb8646763d284c5f9a401a04a.exeMSBuild.exe

description	pid	process	target process
PID 1424 set thread context of 1928	1424	30de81edb8646763d284c5f9a401a04a.exe	MSBuild.exe
PID 1928 set thread context of 1032	1928	MSBuild.exe	MSBuild.exe

Modifies system certificate store 2 TTPs 4 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

30de81edb8646763d284c5f9a401a04a.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43	30de81edb8646763d284c5f9a401a04a.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	30de81edb8646763d284c5f9a401a04a.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	30de81edb8646763d284c5f9a401a04a.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	30de81edb8646763d284c5f9a401a04a.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

30de81edb8646763d284c5f9a401a04a.exeMSBuild.exe

description pid process

Token: SeDebugPrivilege 1424 30de81edb8646763d284c5f9a401a04a.exe
Token: SeDebugPrivilege 1928 MSBuild.exe

description	pid	process
Token: SeDebugPrivilege	1424	30de81edb8646763d284c5f9a401a04a.exe
Token: SeDebugPrivilege	1928	MSBuild.exe

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

30de81edb8646763d284c5f9a401a04a.exeMSBuild.exe

description	pid	process	target process
PID 1424 wrote to memory of 1928	1424	30de81edb8646763d284c5f9a401a04a.exe	MSBuild.exe
PID 1424 wrote to memory of 1928	1424	30de81edb8646763d284c5f9a401a04a.exe	MSBuild.exe
PID 1424 wrote to memory of 1928	1424	30de81edb8646763d284c5f9a401a04a.exe	MSBuild.exe
PID 1424 wrote to memory of 1928	1424	30de81edb8646763d284c5f9a401a04a.exe	MSBuild.exe
PID 1424 wrote to memory of 1928	1424	30de81edb8646763d284c5f9a401a04a.exe	MSBuild.exe
PID 1424 wrote to memory of 1928	1424	30de81edb8646763d284c5f9a401a04a.exe	MSBuild.exe
PID 1424 wrote to memory of 1928	1424	30de81edb8646763d284c5f9a401a04a.exe	MSBuild.exe
PID 1424 wrote to memory of 1928	1424	30de81edb8646763d284c5f9a401a04a.exe	MSBuild.exe
PID 1424 wrote to memory of 1928	1424	30de81edb8646763d284c5f9a401a04a.exe	MSBuild.exe
PID 1424 wrote to memory of 1928	1424	30de81edb8646763d284c5f9a401a04a.exe	MSBuild.exe
PID 1928 wrote to memory of 1032	1928	MSBuild.exe	MSBuild.exe
PID 1928 wrote to memory of 1032	1928	MSBuild.exe	MSBuild.exe
PID 1928 wrote to memory of 1032	1928	MSBuild.exe	MSBuild.exe
PID 1928 wrote to memory of 1032	1928	MSBuild.exe	MSBuild.exe
PID 1928 wrote to memory of 1032	1928	MSBuild.exe	MSBuild.exe
PID 1928 wrote to memory of 1032	1928	MSBuild.exe	MSBuild.exe
PID 1928 wrote to memory of 1032	1928	MSBuild.exe	MSBuild.exe
PID 1928 wrote to memory of 1032	1928	MSBuild.exe	MSBuild.exe
PID 1928 wrote to memory of 1032	1928	MSBuild.exe	MSBuild.exe

C:\Users\Admin\AppData\Local\Temp\30de81edb8646763d284c5f9a401a04a.exe
"C:\Users\Admin\AppData\Local\Temp\30de81edb8646763d284c5f9a401a04a.exe"
1⤵
- Suspicious use of SetThreadContext
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1424

C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"
2⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1928

C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"
3⤵
PID:1032

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

1

T1130

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\lfWfhaRClg.txt
MD5
7627ce511150fe95bd7a0a8c6e702e44

SHA1
0bacfbfbd8af9b76e7057e277eca2af64f2f45f2

SHA256
7b69ba3a69d28f9430cd74e65e405f9e33e926cc4f69c93d53c3d5ec30119ce1

SHA512
bbbda9e0410ec0e56cd55d7146aab4c198f68615b9e53a6cd1b2dd0f3a55844ab88c54133dac5f57b92563e95f1523eabe898247c0d62a9fc66a429db7e675dd

Download Submit
memory/1032-4-0x000000000040D2DE-mapping.dmp

Download
memory/1032-6-0x0000000000080000-0x0000000000094000-memory.dmp

Filesize
80KB

Download
memory/1032-7-0x0000000000080000-0x0000000000094000-memory.dmp

Filesize
80KB

Download
memory/1928-0-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1928-1-0x000000000040FE0E-mapping.dmp

Download
memory/1928-2-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads